Splunk Enterprise Release Notes

Splunk Enterprise 10.0 was released on July 28, 2025. If you are new to Splunk Enterprise, read the Splunk Enterprise Overview. For system requirements information, see the Installation Manual. Before proceeding, review the Known Issues for this release.

Planning to upgrade from an earlier version? If you plan to upgrade to this version from an earlier version of Splunk Enterprise, read How to upgrade Splunk Enterprise in the Installation Manual for information you need to know before you upgrade. See About upgrading: READ THIS FIRST for specific migration tips and information that might affect you when you upgrade. The Deprecated and removed features topic lists computing platforms, browsers, and features for which Splunk has deprecated or removed support in this release.

What's New in 10.0

• Edge Processor service: The Edge Processor solution is a service hosted within your Splunk Enterprise deployment designed to help you manage data ingestion within your network boundaries. Use the Edge Processor solution to filter, mask, and transform your data close to its source before routing the processed data to external environments. For more information, see About the Edge Processor solution.
• Updated support for Federal Information Processing Standards (FIPS): Splunk Enterprise now has updated support for the FIPS Publication #140-2 module and new support for Publication #140-3 module. These modules let you run Splunk Enterprise in FIPS mode to comply with these guidelines. The updated FIPS 140-2 module that comes with Splunk Enterprise 10.0 is valid until March of 2026. This gives you time to move over to the new FIPS 140-3 module after you upgrade both Splunk Enterprise components and your forwarding tier infrastructure to version 10. For more information about Splunk Enterprise and FIPS, see Secure Splunk Enterprise with FIPS. For information about upgrading FIPS in Splunk Enterprise, see Best practice for maintaining compliance with FIPS and Common Criteria in your Splunk Enterprise environment.
• Support for encryption with mutual transport layer security (mTLS): Splunk Enterprise now supports the configuration of mTLS for encryption of network connections between Splunk Enterprise instances and services.
• OpenSSL version 3.0 support: Splunk Enterprise version 10.0 brings support for OpenSSL version 3.0, which replaces the deprecated OpenSSL version 1.0.2. Additionally, the software is bound to version 3.9 of the Python runtime environment for secure connections to services and APIs.
• Fine-grained access to search knowledge objects: Splunk admins now have improved options for assigning permissions to roles for access to knowledge objects. Three new capabilities grant admins increased flexibility in assigning access to the objects and replace the admin_all_objects capability, which was the only option available previously. For more information on configuring fine-grained access for search knowledge objects, see Configure roles for fine-grained management of saved search objects, owners, and properties.
• Sidecars: Sidecars are processes that run alongside the splunkd process to fulfill specific functions. They support introducing new features to the Splunk platform. For example, several sidecars support enhanced data management in the on-premises environment. Sidecars affect your Splunk Enterprise environment by introducing multiple sidecar processes. Process names of sidecars don't include a splunk prefix. To learn more about sidecars, see About Splunk sidecars.
• Dashboards Trusted Domains List: Admins can add and remove domains using the Dashboards Trusted Domains List page. To navigate to this page, in the Splunk bar, select Settings > Server settings > Dashboards Trusted Domains List. To learn more, see Configure Dashboards Trusted Domains List.
• Dashboards in the Audit Trail app: Using the Audit Trail app, you can quickly gain insights on security, compliance, and the operation of a Splunk platform instance. The dashboards help you monitor user activities and changes of knowledge objects in real time, based on data from the audit index, index=_audit. If you notice any issues to troubleshoot or activities to investigate, you can get more details by searching the audit log. It is a good practice to begin an audit of Splunk platform activity by reviewing the Audit Trail dashboards. To learn more about the Audit Trail dashboards, see Auditing activities in a Splunk platform instance.
• Support for the savedsearch command in standard mode federated searches: You can now use the savedsearch command to run federated searches over remote saved search datasets located on standard mode federated providers. In addition, you can use the savedsearch command's string substitution replacement syntax to replace certain strings in the remote saved search with strings of your design, if the remote saved search string contains replacement placeholder terms such as $replace_me$. Note: This feature will be a breaking change for users of the savedsearch command, if they use savedsearch to reference local searches with names that begin with the string federated:. With this release, the savedsearch command will treat any search referencing a saved search name that begins with federated: as a federated search. See the following topics for more information: Run federated searches over remote Splunk platform deployments in Federated Search. The savedsearch reference topic in Search Reference.
• Expanded SPL support for standard mode searches in Federated Search for Splunk: Support has been added for the following commands in standard mode federated searches for Federated Search for Splunk: mcollect sendalert sendemail These commands can now run locally on the federated search head. See SPL commands that run on the federated search head in standard mode.
• Email domains enhancement: A new enhancement for the Email Domains setting under Server settings in Splunk Web lets administrators specify whether to allow or deny all email domains, or use email domains in a comma-separated list. The Email Domains setting restricts the email domains to which alert emails can be sent and prevents users from sending email alerts with search results to any domain, which is a security risk. If you don't want to use Splunk Web to manage email domains, you can configure the allowedDomainList setting in the [email] stanza in the alert_actions.conf file instead.
• OAuth 2.0 support for email server authentication: Splunk Enterprise now supports OAuth 2.0 for SMTP server authentication. This release adds support for Microsoft Exchange Server. For Gmail SMTP server, you can use a Google app password instead of an account password with simple authentication (username/password). See Configure email notification for Splunk Enterprise
• Splunk Enterprise Python 3.9: Python version 3.7 has been removed from Splunk Enterprise 10.0 and higher. Python 3.9 is the only interpreter available in this release. Confirm that all apps and add-ons are on the latest version and compatible with Python 3.9, otherwise those applications might break or not function properly with Splunk Enterprise.
• Dashboard Studio enhancements: See What's new in Dashboard Studio.
• Preview feature: Field filters now support the typeahead and walklex commands: In previous releases of field filters, the typeahead and walklex commands were restricted commands that the Splunk platform turned off by default on indexes with field filters. As of this release, these commands are no longer restricted. For more information about field filters, see Protect PII, PHI, and other sensitive data with field filters. READ THIS FIRST: Should you deploy field filters in your organization? Field filters are a powerful tool that can help many organizations protect their sensitive fields from prying eyes, but they might not be a good fit for everyone. If your organization runs Splunk Enterprise Security or if your users rely heavily on commands that field filters restricts by default (mpreview, mstats, and tstats), do not use field filters in production until you have thoroughly planned how you will work around these restricted commands. See READ THIS: Restricted commands do not work in searches on any indexes if field filters are in use in the Securing Splunk platform manual.
• Preview feature: Field filters are now first in the sequence of search-time operations, which has implications for downstream operations: Field filters have moved to first in the sequence of search-time operations, and are no longer processed fourth in the sequence as in previous releases. Because field filters are processed before all other operations in the sequence, downstream operations that depend on certain field values might break when expected field values are filtered by field filters. See The sequence of search-time operations in the Splunk Platform Knowledge Manager Manual. If your organization uses the Splunk Common Information Model (CIM), and field filters on the Splunk platform to protect sensitive fields, you should also understand the downstream impact of field filters on data model acceleration (DMA). For more information about the impact of field filters on DMA, see Plan for field filters in your organization in the Securing Splunk Platform in the Securing Splunk platform manual.
• Dynamic limit for scheduled searches: Splunk Enterprise 10.0 introduces the dynamic_max_searches_perc setting. This setting allows the search scheduler to automatically adjust the scheduled search concurrency limit (max_searches_perc) based on the ad hoc and scheduled search workload. This feature can reduce search latency, minimize skipped searches, and help you use search capacity more efficiently between ad hoc and scheduled searches. See Dynamically manage scheduled search concurrency limits.
• Effective configuration: This feature lets you view the actual configuration installed on your forwarders without logging into the machines or running btool. This means you no longer need to rely on other teams to access configuration details. With this feature, you can see the real, active settings applied on forwarders, including all parameter changes in .conf files. It gives you a complete picture of the configuration currently in use. You can download the effective configuration files and open them in a text editor for further analysis. See View configurations installed on your forwarders
• Bulk Data Move: Bulk Data Move allows Splunk Enterprise users to efficiently reorganize indexes and move data between them using specific search criteria. Easily reclaim storage and manage sensitive information with precision, avoiding the friction of full index removal. Available for Standalone (single instance) deployments only. See Split indexed data in the Manage Indexes and Indexer Clusters manual.
• OpenTelemetry Collectors: This feature allows you to view information about OTel Collectors you manage, helping you monitor status of your agents in one place. You'll see a list of registered OTel Collectors in a table view. You can view more details along with key attributes by selecting an individual agent. This view-only functionality supports better visibility into how your data collection components are operating. See Monitoring the status of OpenTelemetry Collectors in Splunk Enterprise
• Observability metrics in Dashboard Studio: You can create charts in Dashboard Studio that are based on observability metrics or import an existing Splunk Observability Cloud chart into Dashboard Studio. You can also filter observability-based metrics charts by dimension to look at something more granularly. See Splunk Observability Cloud metrics in Splunk Cloud Platform.
• Preview observability data in the Search app: In a new Related Content panel, you can see previews of Splunk Observability Cloud data and context that are related to an event you are investigating in the Search & Reporting application. See Preview observability data in the Related Content panel.
• View an observability service map in Dashboard Studio dashboards: You can add a service map for services monitored in Splunk Observability Cloud into Dashboard Studio. A service map allows you to see dependencies and connections among your instrumented and inferred services in APM at a glance on the dashboard of your choice in Splunk Cloud Platform. You can then identify performance bottlenecks and error propagation side-by-side with your other charts and graphs. See Add a Splunk Observability Cloud service map to Dashboard Studio dashboards.
• SPL2 module permissions: When you create a module you are automatically given execute, read, and write permissions on that module. Previously, only users with the admin and power roles were granted these permissions on modules. Permissions for the module owner can't be revoked. You can grant or revoke permissions on the modules that you create. Module permissions are set using the REST API endpoints. See Modify permissions for modules in the Splunk Enterprise Admin Manual.
• Deprecated version 1.0 endpoints for the Search API are now deactivated by default: Select version 1.0 endpoints for the Search API have been deprecated and deactivated, and will be removed in a future release. Customers and app developers should upgrade usage of these deactivated endpoints to the new API version, Search API version 2.0. These new Semantic Versioned Rest API endpoints for search improve platform contracts and resiliency to platform updates. If your organization has business-critical apps that still need to use the deactivated endpoints, you can turn them on for a limited time as a temporary fix. See Semantic API versioning in the REST API Reference Manual.
• Sunsetting of the Upgrade Readiness App: Splunk is ending its support of the Upgrade Readiness App. It will no longer be updated and has been removed from this version of Splunk Enterprise. For more information, see Sunsetting of the Upgrade Readiness App.
• Updated alerts page: The alerts page is updated for usability and accessibility. Note: If you configure a custom alert action with HTML, ensure the HTML doesn't include unsupported or malformed elements. Update your HTML to match the supported custom elements for Splunk Web. For more information, see Create the configuration UI for a custom alert actionopen_in_new.
• Favorite knowledge objects: Users can now add and remove reports from favorites. Favorites make insights discovery and accessing knowledge objects, such as reports, easier and faster.
• Agent management can upgrade universal forwarders (Splunk idea EID-I-70open_in_new): With this feature, you can upgrade universal forwarders by installing the Remote Upgrader with elevated privileges just once. After this one-time setup, performed either manually or with automation tools, all future upgrades of universal forwarders can be managed centrally through the agent management (in versions 10.0 and higher of Splunk Enterprise) or deployment server (in versions 9.x of Splunk Enterprise), eliminating the need for repeated manual intervention. To learn more about the Remote Upgrader tool, see About the Splunk Remote Upgrader for Linux Universal Forwarders.

Splunk Enterprise 9.4.3 was released on June 5, 2025. It resolves the issues described in Fixed issues.

• Splunk Enterprise versions 9.4 and higher no longer support KV store server version 4.2.
• Upgrade to KV store server version 7.0 for continued support and security, and to comply with Splunk Support Policy open_in_new. For more details, see Splunk Support Policy open_in_new. Your deployment automatically upgrades your KV store during your upgrade to Splunk Enterprise 9.4. This new server version includes security enhancements and improves the performance of your KV store. See Upgrade the KV store server version open_in_new in the Admin manual to plan your upgrade.

Splunk Enterprise 9.4 was released on December 16, 2024. If you are new to Splunk Enterprise, read the Splunk Enterprise Overview. For system requirements information, see the Installation Manual. Before proceeding, review the Known Issues for this release.

Planning to upgrade from an earlier version? If you plan to upgrade to this version from an earlier version of Splunk Enterprise, read How to upgrade Splunk Enterprise in the Installation Manual for information you need to know before you upgrade. See About upgrading: READ THIS FIRST for specific migration tips and information that might affect you when you upgrade. The Deprecated and removed features topic lists computing platforms, browsers, and features for which Splunk has deprecated or removed support in this release.

What's New in 9.4

• Deployment server version 9.4: Deployment Server provides a centralized location and user-interface to manage, maintain, and troubleshoot all types of Splunk agents, such as the Universal Forwarder and the Heavy Forwarder. Deployment Server 9.4.0 provides the following new capabilities: Overview of the health and status of your agents, A new UI with a shorter load time and updated user experience, Accessibility compliance
• Upgrade KV store server version from 4.2 to 7.0: Splunk Enterprise versions 9.4 and higher work best with KV store server version 7.0. Your deployment automatically upgrades your KV store during your upgrade to Splunk Enterprise 9.4. This new server version includes security enhancements and improves the performance of your KV store. See Upgrade the KV store server version in the Admin manual to plan your upgrade.
• Stats V1 removal: Version 1 of the stats command has been removed and replaced with version 2 of the stats command.
• Enhancement to the foreach command: A new auto_collections mode has been added the foreach command. The auto_collections mode dynamically iterates over a JSON array or multivalue field depending on which element is present in the search. See foreach in the Search Reference.
• Federated Search for Splunk: Metric indexes now supported as a new dataset type for federated searches: With this release, Federated Search for Splunk adds a new dataset type for standard mode federated searches: metric indexes. You can now run federated searches over metric index datasets. Additional error handling has been added to ensure that you apply event generating commands to event index datasets and apply metric generating commands to metric index datasets. Note: This is a breaking change for previous federated searches of metric indexes. If you are upgrading the federated search head on your local deployment from a previous version of the Splunk platform, and you have defined federated indexes on that federated search head that map to index datasets which contain metric data, you must replace those federated indexes with new federated indexes that map to metric index datasets. This update does not require you to make any changes to the remote deployment. For more information about defining federated indexes that map to metric index datasets, see Map a federated index to a remote Splunk dataset in Federated Search. For more information about writing federated searches for metric index datasets, see Run federated searches over remote Splunk platform deployments in Federated Search.
• Federated Search for Splunk: Support for eventcount across Standard and Transparent mode: The eventcount command is now supported by Federated Search for Splunk. This support includes the option to have eventcount return event counts for indexes on remote Splunk platform deployments that are designated as federated providers. eventcount search results now include a provider column that identifies the federated providers that listed indexes belong to. For more information, see eventcount in the Search Reference.
• Federated Search for Splunk: Standard mode federated search support for the mcatalog command: The mcatalog command is now supported for standard mode federated searches. For more information, see the following topics: Run federated searches over remote Splunk platform deployments, in Federated Search. mcatalog, in the Search Reference.
• Internal Library Settings: The Internal Library Settings page is removed. Deprecated libraries and unsupported hotlinked imports are restricted, and Splunk Cloud Platform no longer offers a self-service option to use them. For more information about Internal Library Settings, see Control access to jQuery and other internal librariesopen_in_new in the jQuery Upgrade Readiness manual.
• Dashboard Studio enhancements: See What's new in Dashboard Studio.
• SPL2-based application development: This version of Splunk Enterprise supports SPL2 via API, to help admins create powerful apps to gain more control over their ecosystem while allowing developers massive flexibility for the custom apps they can build. Admins and developers can use the API or the Splunk Extension for VS Code to create their apps. Admins and developers can ship SPL2 module files that define custom functions, views, data types, and more to curate resources within their application for users. Users can leverage these resources in the Splunk search bar to create dashboards and reports, by writing single-statement SPL2 searches. See Create SPL2-based appsopen_in_new in the Splunk Developer Guide on dev.splunk.com Admins can use SPL2 views with run-as-owner permissions. This applies special permissions on modules to execute views under a more privileged context, allowing multiple roles to access sensitive data with different levels of custom data masking. See Manage SPL2-based apps in the Splunk Enterprise Admin Manual.
• Eval function enhancements for data type conversion and type testing: You can use the following new eval data type conversion functions to manipulate values in eval searches. toarray to convert a value to an array value. tobool to convert a value to a boolean value. todouble to convert a value to a double value. toint to convert a value to an integer value. tomv to convert a value to a multivalue. toobject to convert a value to the equivalent object value of the field, if any. json_entries to convert a value to an array of JSON objects with key and value fields. You can use the following new eval functions to return information about values in eval searches. isarray to test whether a value is an array value. isdouble to test whether a value is a double value. ismv to test whether a value is a multivalue. isobjectto test whether a value is an object. json_has_key_exact to test whether a JSON key is in a JSON object. For more information, see Common eval functions in the Splunk Enterprise Search Reference.
• Eliminate SHC out-of-sync issues: Search head cluster (SHC) replication has been improved to reduce out-of-sync errors. Previously, large CSV lookup files that exceeded the 5GB file size limit could block replication and cause cluster members to go out of sync, often requiring a "destructive resync" to remediate. Now if a CSV lookup exceeds the lookup file size limit, the cluster automatically quarantines the lookup on the search head on which it is generated, without blocking replication of other objects. The splunkd health report shows the number of quarantined lookups and admins can run a search to get details on these lookups for remediation. For more information, see Quarantining large CSV lookup files in search head clusters in the Knowledge Manager Manual.
• Workload management - Support for cgroups version 2: Workload management now supports Linux operating systems that use cgroups version 2. Splunk Enterprise 9.4 is enabled by default to automatically detect and switch to cgroups v2. For more information, see Configure cgroups v2 in Splunk Enterprise in Workload Management.
• Support for persistent queues for Output queues with Splunk to Splunk (S2S) protocol: Ability to leverage persistent queues on output queues to automatically fallback to disk and recover, in case of destination or network failure. Use cases are for collection purpose for remote Splunk deployment (intermittent connectivity or need to survive a long network outage) and/or cloning data to one or multiple Splunk destinations, via S2S protocol, with no data loss and minimal impact in case of destination unavailability.